The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:2284-2 advisory.

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:3661 advisory.

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3946 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3946-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     November 05, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : context     Version        : 2020.03.10.20200331-1+deb11u1

    Context a general-purpose document processor was affected by     CVE-2023-32700 fix that by default disable luasocket.

    This bugfix release, fix the mtxrun program used at install time     of context (postinst) that was broken by CVE-2023-32700 patch.

    For Debian 11 bullseye, this problem has been fixed in version     2020.03.10.20200331-1+deb11u1.

    We recommend that you upgrade your context packages.

    For the detailed security status of context please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/context

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0195 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-32700:
      LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained     from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This     also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3427 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3427-2                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     May 31, 2023                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : texlive-bin     Version        : 2018.20181218.49446-1+deb10u2     CVE ID         : CVE-2019-18604     Debian Bug     : 1036891

    It was discovered that the patch to fix CVE-2023-32700 in texlive-bin, released     as DLA-3427-1, was incomplete and caused an error when running the lualatex     command.

    The following security vulnerability has been addressed as well.

    CVE-2019-18604

         A flaw was found in axohelp in axodraw2. The sprintf function is          mishandled which may cause a stack overflow error.

    For Debian 10 buster, this problem has been fixed in version     2018.20181218.49446-1+deb10u2.

    We recommend that you upgrade your texlive-bin packages.

    For the detailed security status of texlive-bin please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/texlive-bin

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6081:02 advisory.

    * texlive: arbitrary code execution allows document complied with older     version (CVE-2023-32700)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5406 advisory.

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2285-1 advisory.

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2287-1 advisory.

  - cups-filters contains backends, filters, and other software required to get the cups printing service     working on operating systems other than macos. If you use the Backend Error Handler (beh) to create an     accessible network printer, this security vulnerability can cause remote code execution. `beh.c` contains     the line `retval = system(cmdline) >> 8;` which calls the `system` command with the operand `cmdline`.
    `cmdline` contains multiple user controlled, unsanitized values. As a result an attacker with network     access to the hosted print server can exploit this vulnerability to inject system commands which are     executed in the context of the running server. This issue has been addressed in commit `8f2740357` and is     expected to be bundled in the next release. Users are advised to upgrade when possible and to restrict     access to network printers in the meantime. (CVE-2023-24805)

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-38094d905c advisory.

    Fixes CVE-2023-32700. Also fixes issues with mptopdf.pl, thumb2pdf.pl, and mtxrun.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the texlive-20200406-26.el9 build changelog.

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has texlive-base packages installed that are affected by a vulnerability:

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6183:03 advisory.

    * texlive: arbitrary code execution allows document complied with older version (CVE-2023-32700)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-3661 advisory.

    [9:20200406-26]
    - Resolves: #2209872, CVE-2023-32700

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
178696	openSUSE 15 Security Update : texlive (SUSE-SU-2023:2284-2)	Nessus	SuSE Local Security Checks	2023/7/21	2023/7/21	high
190204	CentOS 8 : texlive (CESA-2023:3661)	Nessus	CentOS Local Security Checks	2024/2/8	2024/2/8	high
210378	Debian dla-3946 : context - security update	Nessus	Debian Local Security Checks	2024/11/5	2024/11/5	high
226645	Linux Distros Unpatched Vulnerability : CVE-2023-32700	Nessus	Misc.	2025/3/5	2025/9/2	high
239406	TencentOS Server 3: texlive (TSSA-2023:0195)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
176221	Debian dla-3427 : libkpathsea-dev - security update	Nessus	Debian Local Security Checks	2023/5/23	2025/1/22	critical
293666	MiracleLinux 9 : texlive-20200406-26.el9 (AXSA:2023-6081:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
176150	Debian DSA-5406-1 : texlive-bin - security update	Nessus	Debian Local Security Checks	2023/5/20	2023/8/2	high
176354	SUSE SLES15 / openSUSE 15 Security Update : texlive (SUSE-SU-2023:2285-1)	Nessus	SuSE Local Security Checks	2023/5/25	2023/7/14	high
176355	SUSE SLES15 / openSUSE 15 Security Update : cups-filters, poppler, texlive (SUSE-SU-2023:2287-1)	Nessus	SuSE Local Security Checks	2023/5/25	2023/7/14	high
176499	Fedora 38 : texlive-base (2023-38094d905c)	Nessus	Fedora Local Security Checks	2023/5/30	2024/11/15	high
191402	CentOS 9 : texlive-20200406-26.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	high
242701	NewStart CGSL MAIN 7.02 : texlive-base Vulnerability (NS-SA-2025-0137)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	high
292399	MiracleLinux 8 : texlive-20180414-29.el8 (AXSA:2023-6183:03)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
177521	Oracle Linux 8 / 9 : texlive (ELSA-2023-3661)	Nessus	Oracle Linux Local Security Checks	2023/6/22	2025/9/9	high

检测

插件搜索

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high